[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does PDA Forensic Tools_ an Overview and Analysis provide? (Part 5)

[Assistant] ## Table of Contents | INTRODUCTION..........................................................................................................................1 | | |---------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------| | BACKGROUND............................................................................................................................2 | | | REMOVABLEMEDIA................................................................................................................4 | | | PDAFORENSIC TOOLKITS......................................................................................................6 | | | PDASEIZURE | ..............................................................................................................................6 | | ENCASE........................................................................................................................................7 | | | PALMDD ( PDD ) | .............................................................................................................................7 | | PILOT-LINK | ..................................................................................................................................8 | | POSE............................................................................................................................................8 | | | DUPLICATE DISK (DD )..................................................................................................................9 | | | MISCELLANEOUS TOOLS..............................................................................................................9 | | | SYNOPSIS OF PDASEIZURE..................................................................................................10 | | | POCKET | PC.................................................................................................................................10 | | PALM OS....................................................................................................................................10 | | | ACQUISITION STAGE | ..................................................................................................................12 | | SEARCH FUNCTIONALITY | ..........................................................................................................14 | | GRAPHICS LIBRARY ...................................................................................................................15 | | | BOOKMARKING..........................................................................................................................16 | | | ADDITIONAL TOOLS...................................................................................................................17 | | | REPORT GENERATION................................................................................................................18 | | | PASSWORD CRACKING...............................................................................................................19 | | | SYNOPSIS OF ENCASE............................................................................................................21 | | | ACQUISITION STAGE ..................................................................................................................21 | | | SEARCH FUNCTIONALITY ..........................................................................................................22 | | | SCRIPTS | ......................................................................................................................................25 | | GRAPHICS LIBRARY | ...................................................................................................................26 | | ENSCRIPT &FILTERS.................................................................................................................26 | | | REPORT GENERATION................................................................................................................27 | | | SYNOPSIS OF PDD .....................................................................................................................28 | | | SYNOPSIS OF PILOT-LINK.....................................................................................................29 | | | SYNOPSIS OF DD | .......................................................................................................................30 | | ANALYSIS OVERVIEW...........................................................................................................31 | | | SCENARIOS | .................................................................................................................................31 | | DEVICES | .....................................................................................................................................34 | | PDASEIZURE OUTCOME-POCKETPC............................................................................36 | | | JORNADA 548.............................................................................................................................36 | | | IPAQ 3875/3970/5455

PDA Forensic Tools_ an Overview and Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.5. 3.2.5) option. 3.2.5) with a non-exportable authentication
key (see Sec.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.6 (NIST 3.1.6)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.6. 3.1.6.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Directions in Security Metrics Research:

com/australia/portals/2/pdf/1650\_print.pdf
- [Bel06] Steven Bellovin, On the Brittleness of Software and the Infeasibility of Security Metrics, IEEE Security and Privacy, Volume 4, Issue 4, July-Aug.
2006
- [Ber05] Scott Berinato, A Few Good Information Security Metrics, CSO Magazine, July 01, 2005, http://www.csoonline.com/article/220462/A\_Few\_Good\_Information\_Security \_Metrics?contentId=220462&slug=&
- [Bla04] Matt Blaze, Safecracking for the Computer Scientist, Draft Document, December 21, 2004, http://www.crypto.com/papers/safelocks.pdf
- [Bow02] Jim Bowring, Alessandro Orso, Mary Jean Harrold, Monitoring Deployed on Program Analysis for Software Tools and Engineering, Charleston, South
- Software Using Software Tomography, ACM SIGPLAN-SIGSOFT Workshop Carolina, November 2002, http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=A3CE0E004AF88F94 805FBCE9DCFFB558?doi=10.1.1.8.7773&rep=rep1&type=pdf
- [Bre07] Bill Brenner, Windows Admins Feel Post-Patch Tuesday Pain, SearchSecurity.com, October 19, 2007, http://searchsecurity.techtarget.com/news/article/0,289142,sid14\_gci1277683,0 0.html
- [Car08] Lawrence Carin, George Cybenko, Jeff Hughes, Cybersecurity Strategies: The QuERIES Methodology, IEEE Computer, Vol. 41, No. 8, August 2008
- [CCP06] Common Criteria for Information Technology Security Evaluation Part 1: Introduction and general model, Common Criteria Portal, September 2006, Version 3.1 Revision 1, http://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R1.pdf
- [CEC91] Information Technology Security Evaluation Criteria (ITSEC), Harmonised Criteria of France - Germany - the Netherlands - the United Kingdom, Commission of the European Communities Directorate XIII/F SOG-IS, June 1991, http://www.iwar.org.uk/comsec/resources/standards/itsec.htm
- [Cha06] Pravir Chandra, Brian Chess, John Steven, Putting the Tools to Work: How to Succeed with Source Code Analysis, IEEE Security & Privacy, vol. 4, no.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards:

| Function   | Category Unique Identifier   | Category                               |
|------------|------------------------------|----------------------------------------|
| Identify   | ID. AM                       | Asset Management                       |
| Identify   | ID. BE                       | Business Environment                   |
| Identify   | ID.

Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

| PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes ISO/IEC 27001:2013 A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 NIST SP 800-53 Rev. 5 AC-1, AC- 2, IA-1, IA-2, IA-3, IA-4, IA-5, IA- 6, IA-7, IA-8, IA-9, IA-10, IA-11 | Most ransomware attacks are conducted through network connections, and ransomware attacks often start with credential compromise (e.g., unauthorized sharing or capture of login identity and password). Proper credential management is essential, although not the only mitigation needed. |
| Identity Management, Authentication and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions. | PR.AC-3: Remote access is managed ISO/IEC 27001:2013 A.6.2.1, A.6.2.2, A.11.2.6, A.13.1.1, A.13.2.1 NIST SP 800-53 Rev. 5 AC-1, AC- 17, AC-19, AC-20, SC-15                                                                                | Most ransomware attacks are conducted remotely. Managing privileges associated with remote access can help maintain the integrity of systems and data files to protect against malicious code insertion and data exfiltration. Using multi-factor authentication is a key - and easily implemented - way to reduce the likelihood of account compromise. |
| Identity Management, Authentication and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IT Security for Industrial Control Systems provide? (Part 2)

[Assistant]
ing with security professionals to assess the vulnerabilities and establish appropriate strategies for the development of policies to reduce IT security risk within the U.S. process controls industry.
The outcome of this work will be the development and dissemination of best practices and ultimately Common Criteria, ISO/IEC 15408 based security specifications that will be used in the procurement, development, and retrofit of industrial control systems. In support of this work this paper addresses the computer control systems used within process control industries, their similarities, and network architectures. A generic set of networking system architectures for industrial process control systems is presented. The vulnerabilities associated with these systems and the IT threats these systems are exposed to are also presented along with a discussion of the Common Criteria and its intended use for these efforts. The current status as well as future efforts of the PCSRF are also discussed. ## Introduction

The National Institute of Standards and Technology (NIST), Intelligent Systems Division of the Manufacturing Engineering Laboratory is working with the NIST Information Technology Laboratory and the NIST Electrical and Electronics Engineering Laboratory to improve the IT security of networked digital control systems used in industrial applications. This effort is being carried out through the Process Control Security Requirements Forum (PCSRF), an industry group organized under the National Information Assurance Program (NIAP). NIAP is a joint effort between the NIST and the National Security Agency (NSA). As part of the Critical Infrastructure Protection Program, NIST and NSA are working to provide technical support and guidance to industry to improve the Nation's security posture.

IT Security for Industrial Control Systems

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 5)

[Assistant]
................................................................... | Executive Summary.................................................................................................................
| Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body ....................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Control Baselines for Information Systems and Organizations provide?

[Assistant]
## Control Baselines for Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-53B

<!-- image -->

## NIST Special Publication 800-53B

## Control Baselines for Information Systems and Organizations

## JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

## October 2020

INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XI

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Minimum Security Requirements for Federal Information and Information Systems:

The minimum security requirements cover seventeen security-related areas with regard to protecting the confidentiality, integrity, and availability of federal information systems and the information processed, stored, and transmitted by those systems.  The security-related areas include: (i) access control; (ii) awareness and training; (iii) audit and accountability; (iv) certification, accreditation, and security assessments; (v) configuration management; (vi) contingency planning; (vii) identification and authentication; (viii) incident response; (ix) maintenance; (x) media protection; (xi) physical and environmental protection; (xii) planning; (xiii) personnel security; (xiv) risk assessment; (xv) systems and services acquisition; (xvi) system and communications protection; and (xvii) system and information integrity.  The seventeen areas represent a broad-based, balanced information security program that addresses the management, operational, and technical aspects of protecting federal information and information systems.

Physical and Environmental Protection (PE): Organizations must: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals; (ii) protect the physical plant and support infrastructure for information systems; (iii) provide supporting utilities for information systems; (iv) protect information systems against environmental hazards; and (v) provide appropriate environmental controls in facilities containing information systems.

MEDIA: Physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, Large-Scale Integration (LSI) memory chips, printouts (but not including display media) onto which information is recorded, stored, or printed within an information system.

Minimum Security Requirements for Federal Information and Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

3.3.4 Security Tag Type 3    | 4. 3.3.4 Security Tag Type 3    | 4. 3.3.4 Security Tag Type 3    | 4.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Minimum Security Requirements for Federal Information and Information Systems:

The minimum security requirements cover seventeen security-related areas with regard to protecting the confidentiality, integrity, and availability of federal information systems and the information processed, stored, and transmitted by those systems. The security-related areas include: (i) access control; (ii) awareness and training; (iii) audit and accountability; (iv) certification, accreditation, and security assessments; (v) configuration management; (vi) contingency planning; (vii) identification and authentication; (viii) incident response; (ix) maintenance; (x) media protection; (xi) physical and environmental protection; (xii) planning; (xiii) personnel security; (xiv) risk assessment; (xv) systems and services acquisition; (xvi) system and communications protection; and (xvii) system and information integrity. The seventeen areas represent a broad-based, balanced information security program that addresses the management, operational, and technical aspects of protecting federal information and information systems. Audit and Accountability (AU): Organizations must: (i) create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Computer Security Division 2007 Annual Report:

To keep pace with the rate of change in emerging technologies, we conduct a large amount of research in existing and emerging technology areas.  Some of the many topics we research include smart card infrastructure and security, wireless  and  mobile  device  security, Voice  over  IP  security  issues,  digital forensics tools and methods, access control and authorization management, Internet Protocol security, intrusion detection systems, quantum information system security and quantum cryptography, and vulnerability analysis.  Our research helps to fulfill specific needs by the federal government that would not be easily or reliably filled otherwise.

## Digital Handheld Device Forensics

Cell  phones  are  ubiquitous  today,  used  by  individuals  for  both  personal and professional purposes.  Because of their pervasiveness and information content, cell phones  are  an  emerging  but  rapidly growing  area  of computer forensics.  Besides placing calls, cell phones can allow users to perform additional tasks such as Short Message Service (SMS) messaging, Multimedia Messaging  Service (MMS)  messaging,  Instant  Messaging (IM),  e-mail  exchange, Web  browsing,  Personal  Information  Management (PIM) administration (e.g., address book, task list, and calendar schedule), photo and video capture, and even the reading, editing, and production of digital documents.  Over time, a significant amount of information tends to accumulate on them that may be connected with an incident or crime and recovered during an investigation.

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Stateless Hash-Based Digital Signature Standard provide? (Part 5)

[Assistant]
eral Information Processing Standard (FIPS) publication,
- b. Adopted in a FIPS or NIST recommendation, or
- c. Specified in the list of approved security functions in SP 800-140C. 10. Export Control.
Certain cryptographic devices and technical data regarding them are subject to federal export controls. Exports of cryptographic modules that implement this standard and technical data regarding them must comply with these federal regulations and be licensed by the Bureau of Industry and Security of the U.S. Department of Commerce. Information about export regulations is available at https://www.bis.doc.gov. 11. Patents. The algorithm in this standard may be covered by U.S. or foreign patents. 12. Implementation Schedule. This standard becomes effective immediately upon final publication. 13. Specifications. Federal Information Processing Standard (FIPS) 205, Stateless Hash-Based Digital Signature Standard (affixed). 14. Qualifications. The security of a digital signature system depends on the secrecy of the signatory's private keys. Signatories shall , therefore, guard against the disclosure of their private keys. While it is the intent of this standard to specify general security requirements for generating digital signatures, conformance to this standard does not ensure that a particular implementation is secure. It is the responsibility of an implementer to ensure that any module that implements a digital signature capability is designed and built in a secure manner. Similarly, the use of a product containing an implementation that conforms to this standard does not guarantee the security of the overall system in which the product is used. The responsible authority in each agency or department shall ensure that an overall implementation provides an acceptable level of security.

Stateless Hash-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management:

room number).. | To ensure that managers can find the device to revalidate it for supply chain risk management. • Remove it if unauthorized             |
| The period of time the device is authorized.
Local enhancements might include: • When the device must be physically inspected/verified for supply chain risk management                                                                                | To allow previously authorized devices to remain in the authorized hardware inventory, but know such devices are no longer authorized. |
| Expected status of the device (e.g., authorized, expired, pending approval, missing) to include: • Date first authorized; • Date of most recent authorization; and • Date authorization revoked. Local enhancements might include: • Returned from high-risk location; • Removed pending reauthorization; and • Date of last status change. | To determine which devices in the authorized hardware inventory are not likely to be found in actual state inventory. |

Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective:

'America's economic prosperity, national security, and our individual liberties depend on our commitment to securing cyberspace and maintaining an open, interoperable, secure, and reliable Internet. Our critical infrastructure continues to be at risk from threats in cyberspace, and our economy is harmed by the theft of our intellectual property. Although the threats are serious and they constantly evolve, I believe that if we address them effectively, we can ensure that the Internet remains an engine for economic growth and a platform for the free exchange of ideas.' 1

Cyber Incident Management standards support information sharing processes, products, and technology implementations for cyber incident identification, handling, and remediation. Such standards enable organizations to identify when a cyber incident has occurred, to properly respond to that incident and recover from any losses as a result of the incident.  Such standards are one method to enable jurisdictions to exchange information about incidents, vulnerabilities, threats and attacks, the system(s) that were exploited, security configurations and weaknesses that could be exploited, etc.

Security Automation and Continuous Monitoring (SACM) s tandards describe protocols and data formats that enable the ongoing, automated collection, monitoring, verification, and maintenance of software, system, and network security configurations, and provide greater awareness of vulnerabilities and threats to support organizational risk management decisions. Automation protocols also include standards for machine-readable vulnerability identification and metrics, platform and asset identification, actionable threat information and policy triggers for actions to respond to threats and policy violations.  Automated activities would include a Security Operation Center (SOC) to ensure autonomous and continuing monitoring and evolution of the security state of assets based upon prescribed events.

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

| DTR No:         | DTR Description                                                                                | Spec. Reference                                                             |
|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
|                 | common-derived-pivAuth (OID = 2.16.840.1.101.3.2.1.3.40) or id-fpki-common- derived-pivAuth-hardware (OID = 2.16.840.1.101.3.2.1.3.41). | Authentication Certificate Profile                                          |
| DTR-07.03.01.07 | The subjectAltName extension shall include a UUID encoded as a URN, as specified in Section 3 of [RFC4122], A Universally Unique IDentifier (UUID) URN Namespace . | • [PROF], Worksheet titled - Derived PIV Authentication Certificate Profile |
| DTR-07.03.01.08 | The piv-interim extension (OID = 2.16.840.1.101.3.6.9.1) shall be present and contain an interim_indicator field, which is populated with a Boolean value. This extension is not critical. | • [PROF], Worksheet titled - Derived PIV Authentication Certificate Profile |
| DTR-07.03.01.09 | The authorityInfoAccess field shall contain an id-ad-ocsp accessMethod.

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

IMDs are tiny computing platforms that run firmware in extremely power constrained environments. They offer data storage for static data (such as device information), relatively static data (such as patient identification, medical condition, therapy configuration) and dynamic data (such as recent patient readings and audit logs). IMDs offer wireless access for read and write  operations  to  the  data  on  the  IMD  (including  the  firmware) to a variety of stakeholders and roles.

Some of the threats to wireless IMDs include device reprogramming,  data  extraction,  data  tampering,  repeated  access attempts  and  data  flooding.  Vulnerabilities  include  unsecured communication channels, inadequate authentication and access control,  weak  audit  mechanisms  and  meager  storage.  The  resulting risks include patient safety compromise resulting from firmware malfunction or therapy misconfiguration, device unavailability due to battery power depletion, patient privacy loss due to data leakage to unauthorized parties, and inappropriate medical follow-up due to tampering of patient readings. While some cyber threats may be unintentional, various motivations exist  for  deliberate  cyber  attacks,  such  as  patient  information gathering, negative impact to patient health status, ego satisfaction of the attacker, as well as gaining competitive advantage over another vendor through negative press.

Identification of the various data types within an IMD is an essential  step  in  analyzing  the  security  and  privacy  risks  of such  devices.  Possible  data  types  include  firmware  (though technically not 'data'), device identification data, patient identification and health condition data, therapy configuration data, patient readings, audit log data, and other data.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines on Mobile Device Forensics:

.................................................................... | LIST OFTABLES....................................................................................................................
| VIII                                                                                |
| EXECUTIVE SUMMARY........................................................................................................... | EXECUTIVE SUMMARY........................................................................................................... | 1                                                                                |
| 1. INTRODUCTION.................................................................................................................. | 1. INTRODUCTION.................................................................................................................. | 1                                                                                |
| 1.1                                                                                | PURPOSEAND SCOPE ......................................................................................................... | 1                                                                                |
| 1.2                                                                                | AUDIENCEAND ASSUMPTIONS ..........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to LTE Security:

cellular security; networking; Long Term Evolution; 3 rd Generation Partnership Project (3GPP); LTE; telecommunications; wireless.

This document introduces high-level LTE concepts and discusses technical LTE security mechanisms in detail. Technical readers are expected to understand fundamental networking concepts and general network security. It is intended to assist those evaluating, adopting, and operating LTE networks, specifically telecommunications engineers, system administrators, cybersecurity practitioners, and security researchers.

The mobile device hardware, mobile operating system (e.g., Android, Blackberry, iOS, Windows Phone), and 3rd party mobile applications are generally out of the scope of this document unless otherwise noted. This document does not analyze non 3rd Generation Partnership Project (3GPP) networks (e.g., WiFi, WiMAX, 3GPP2), forthcoming 3GPP features such as device to device cellular communications and cellular internet of things (IoT),  and the over-the-air (OTA) management updates to cellular platforms, and the networks supporting services (e.g Domain Name Services (DNS), Network Time Protocol (NTP)). Supply chain issues relating to cellular networks are also not described. Finally, the IP Multimedia Subsystem (IMS), a modern platform for delivering services such as Voice over LTE (VoLTE), is not included within this document.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report:

|                                                                                | Introduction: Workshop Objective, Participants, and Agenda.......................................1                                                                                |
|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Workshop Session Highlights and Summaries................................................................5                                                                                |
| HPC                                                                                | Architecture and Security Posture ........................................................................5                                                                                |
|                                                                                | HPC Operator Security Experience...............................................................................6                                                                                |
|                                                                                | Risk Management Framework Development, Implementation, and Assessment.........7                                                                                |
| 2.3.1.

3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to 2016 NIST_ITL Cybersecurity Program Annual Report:

| ACKNOWLEDGMENTS...................................................................................................................................................................V | ACKNOWLEDGMENTS...................................................................................................................................................................V | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | TRADEMARK INFORMATION.........................................................................................................................................................V | TRADEMARK INFORMATION.........................................................................................................................................................V | | WELCOME LETTER..........................................................................................................................................................................1 | WELCOME LETTER..........................................................................................................................................................................1 | | BACKGROUND INFORMATION OF ANNUAL REPORT..................................................................................................................

2016 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

3.1.2. 3.1.2. 3.1.2 and 3.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards provide? (Part 4)

[Assistant]
lifecycle for cybersecurity risk. Underlying the five concurrent Functions, the Core identifies 23 Categories (as shown in Table 1) and 108 Subcategories that describe discrete cybersecurity outcomes.
The Core also presents informative references for each of the Subcategories that include industry standards, guidelines, and practices. Table 1 - CSF Functions and Categories

| Function   | Category Unique Identifier   | Category                               |
|------------|------------------------------|----------------------------------------|
| Identify   | ID. AM                       | Asset Management                       |
| Identify   | ID. BE                       | Business Environment                   |
| Identify   | ID.

Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 4)

[Assistant]
NA]), and the evolving wide area network (WAN) infrastructure to provide a comprehensive set of security services for the modern enterprise network landscape (e.g., secure access service edge [SASE]).
## Keywords

cloud access security broker (CASB); firewall; microsegmentation; secure access service edge (SASE); secure web gateway (SWG); security orchestration, automation, and response (SOAR); software-defined perimeter (SDP); software-defined wide area network (SD-WAN); virtual private network (VPN); zero trust network access (ZTNA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------| | | | | R4: Permit indirect access only to model weights.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 1?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Karen Scarfone Matthew Smith

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

<!-- image -->

## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Applied Cybersecurity Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

Matthew Smith Huntington Ingalls Industries Annapolis Junction, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

May 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259A 23 pages (May 2020)

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guidelines for API Protection for Cloud-Native Systems provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-228

## Guidelines for API Protection for Cloud-Native Systems

Ramaswamy Chandramouli Zack Butcher

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-228

<!-- image -->

## NIST Special Publication 800 NIST SP 800-228

## Guidelines for API Protection for Cloud-Native Systems

Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

Zack Butcher Tetrate, Inc. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-228

June 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to A Framework for Designing Cryptographic Key Management Systems:

| Controlling Human Input ...............................................................................
| 58                                                                                |
| 6.7.4                                                                                | 6.7.4                                                                                | Multiparty Control.......................................................................................... | 58                                                                                |
| 6.7.5                                                                                | 6.7.5                                                                                | Key Splitting .................................................................................................. | 59                                                                                |
| 6.8 Compromise Recovery ......................................................................................... | 6.8 Compromise Recovery ......................................................................................... | 6.8 Compromise Recovery .........................................................................................

A Framework for Designing Cryptographic Key Management Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992:

| 5.1 Kerberos Authentication/Access Control System - Jeff Schiller, Massachusetts | | | 5.2 | 5.2 | tute of Technology Supercomputer Center Access Control Requirements, Dan Nessett, Lawrence Liver- more National Laboratory | 16 20 | | 5.3 | 5.3 | General Discussion on Access Control | 22 | | 6 | 6 | | 27 | | | Session on Application Security in Distributed Networks | Session on Application Security in Distributed Networks | | | 6.1 | 6.1 | Center 6.2 An Overview of Internet Privacy Enhanced Mail - Steve Kent, Bolt, Beranek, and Newman | 27 30 | | 6.3 | 6.3 | Security in Open Systems Technology Demonstrator Programme - John Laws, Defence Research Agency, UK | 35 | | 7 | | | 38 | | 7.1 | 7.1 | Session on Security Mcmagement in Distributed Networks SDNS Security Management - Wayne Jansen, National Institute of Standards and Technology | 38 | | 7.2 | 7.2 | FIRST System - Dennis Steinauer, National Institute of Standards and Technology | 41 | | 7.3 | 7.3 | CERT Activities - Dain Gary, Software Engineering Institute, Carnegie-Mellon Uni- versity | 43 | | 8 | Session on

Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary.................................................................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Key Management_ Part 1 – General:

d for the protection of sensitive, unclassified government information. 2. They  often  establish  some  level  of  interoperability  between  different  systems  that implement  the  NIST  standards.
For  example,  two  products  that  both  implement  the Advanced  Encryption  Standard  (AES) 10 cryptographic  algorithm  have  the  potential  to interoperate, provided that the other functions of the product are compatible. 3. They  often  provide  for  scalability  because  the  U.S. government  requires  products  and techniques that can be effectively applied in large numbers. 4. They are scrutinized by U.S. government experts and the public to ensure that they provide a high level of security. The NIST standards process invites broad public participation, not only through the formal NIST public review process before adoption but also by interaction with  the  open  cryptographic  community  through  NIST  workshops,  participation  in voluntary  standards  development  organizations,  participation  in  cryptographic  research conferences,  and  informal  contacts  with  researchers. NIST  encourages  the  study  and

Recommendation for Key Management_ Part 1 – General


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

3.2.1, Appendix F. 3.2.1 [NIST-SP800-53r5] CP-2, CP-3, IR-3, IR-8 [NIST-SP800-61r2]                                                                                |
| RS.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

3.2.5. 3.2.5.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Computer Security Division 2007 Annual Report:

53 | | Computer Security Division Publications - FY 2007 | 54 | | Ways to Engage Our Division and NIST | 56 |

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1:

| XCCDF Fact                               | Description of Use                                            |
|------------------------------------------|---------------------------------------------------------------|
| urn:scap:fact:asset:identifier:mac       | Ethernet media access control address                         |
| urn:scap:fact:asset:identifier:ipv4      | Internet Protocol version 4 address                           |
| urn:scap:fact:asset:identifier:ipv6      | Internet Protocol version 6 address                           |
| urn:scap:fact:asset:identifier:host_name | Host name of the asset, if assigned                           |
| urn:scap:fact:asset:identifier:fqdn      | Fully qualified domain name                                   |
| urn:scap:fact:asset:identifier:ein       | Equipment identification number or other inventory tag number |

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case:

Alpha has ten full-time employees, and six of those are machine operators. Alpha has no fulltime control system engineers, or on-site IT or operational technology (OT) personnel. None of the employees have any formal cybersecurity training.

Additionally, personnel security is addressed through pre-employment screenings, adequate position descriptions, terms of employment, and cybersecurity education and training. Additional details regarding physical security requirements are mentioned in Section 3.2.6 Physical Security of the Cybersecurity Policy.

## Cybersecurity Awareness Training

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Security Recommendations for Server-based Hypervisor Platforms provide?

[Assistant]
## NIST Special Publication 800-125A Revision 1

## Security Recommendations for Server-based Hypervisor Platforms

Ramaswamy Chandramouli

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-125Ar1

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-125A

## Revision 1

## Security Recommendations for Server-based Hypervisor Platforms

Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-125Ar1

June 2018

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.

Security Recommendations for Server-based Hypervisor Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight:

sistent set of indicators. Status could be a simple indicator (e.g., open, closed, pending, waived, transferred) or provide a more detailed explanation (e.g., 'risk accepted pending review by the Jan.
24 quarterly risk committee meeting').

Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Representation of PIV Chain-of-Trust for Import and Export:

| 1 Introduction ............................................................................................................1   | 1 Introduction ............................................................................................................1   | 1 Introduction ............................................................................................................1   |
|--------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | 1.1                                                                                | Background..................................................................................................... 1              |
|                                                                                | 1.2 Purpose and Scope                                                                                | ........................................................................................ 1                                     |
|                                                                                | 1.3 Document                                                                                | Structure........................................................................................

Representation of PIV Chain-of-Trust for Import and Export


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Considerations for Remote Electronic UOCAVA Voting provide? (Part 2)

[Assistant]
ments, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, organizations may wish to closely follow the development of these new publications by NIST.
## TABLE OF CONTENTS

| 1 INTRODUCTION .......................................................................... 1      | 1 INTRODUCTION .......................................................................... 1      | 1 INTRODUCTION .......................................................................... 1      |
|--------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSE AND SCOPE......................................................................2         |                                                                                |
| 1.2                                                                                | INTENDED AUDIENCE ......................................................................2        |                                                                                |
| 1.3                                                                                | ORGANIZATION.............................................................................2       |                                                                                |
| 2 GENERAL ARCHITECTURE............................................................ 4             | 2 GENERAL ARCHITECTURE............................................................ 4             | 2 GENERAL ARCHITECTURE............................................................

Security Considerations for Remote Electronic UOCAVA Voting


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Guide to Storage Encryption Technologies for End User Devices:

3.3.3 Use Case 3: Sharing Data with Contractor... 3.3.3 Use Case 3: Sharing Data with Contractor

A user wants to provide a contractor with copies of large data sets on a daily basis because the contractor has no direct access to the system containing the data.

Guide to Storage Encryption Technologies for End User Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies, may be used by federal agencies even before the completion  of  such  companion  publications.  Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

assess; authorization to operate; authorization to use; authorizing official; categorize; common control; common control authorization; common control provider; continuous monitoring; control assessor; control baseline; cybersecurity framework profile; hybrid control; information owner or steward; information security; monitor; ongoing authorization; plan of action and milestones; privacy; privacy assessment report; privacy control; privacy plan; privacy risk; risk assessment; risk executive function; risk management; risk management framework; security; security assessment report; security control; security engineering; security plan; security risk; senior agency information security officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.

'… Effective management of cybersecurity risk requires that agencies align information security management processes with strategic, operational, and budgetary planning processes…'

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.2.5, 3. 3.2.5, 3.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-01-31

## How to Cite this NIST Technical Series Publication:

Chandramouli R, Kautz F, Torres-Arias S (2024) Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-204D. https://doi.org/10.6028/NIST.SP.800-204D

## Author ORCID iDs

Ramaswamy Chandramouli: 0000-0002-7387-5858

## Contact Information

sp800-204d-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/204/d/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The predominant application architecture for cloud-native applications consists of multiple microservices, accompanied in some instances by a centralized application infrastructure, such as a service mesh, that provides all application services. This class of applications is generally developed using a flexible and agile software development paradigm called DevSecOps.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report of the Workshop on Cryptography in Support of Computer Security provide? (Part 2)

[Assistant]
21-22, 1976. The workshop was organized to obtain expert opinions on the mathematical and statistical characteristics of the proposed Data Encryption Standard (DES) as it relates to computer security.
This report summarizes formal presentations that were made, outlines major issues that were raised, quotes statements that were made for the record and answers several of the major ques- tions that were asked. Key words: Cryptanalysis ; cryptography; encryption; key management; known plaintext attack; security; work factor. ## 1 . EXECUTIVE SUMMARY

## 1 . 1 Organization

1 . The workshop was divided into three time periods introduction, parallel working sessions, and summary. 2. A total of 42 people attended from the Federal Government, industry and universities. 3. The workshop chairman was Professor Julian Bigelow, the Mathematics group leader was Dr. Howard Campaigne and the Applications group leader was Dr. Joseph Eachus. ## 1.2 Introductory Session

1. The purposes of the introductory session were to introduce the objectives of the workshop, i.e., to analyze the mathematical and statistical characteristics of the proposed Data Encryption Standard (DES); to provide a forum for identifying potential weaknesses of the DES; and to develop procedures for generating and distributing keys. 2. Individual participants presented a description of the DES, the results of a previous NBS sponsored workshop on technology affecting the DES, and preliminary analysis of the DES. 3. Professor Martin Heilman, of Stanford University, presented a prepared statement. 4. Mr. John Scantlin, of the Lexar Corp., submitted for distribution a written paper which analyzed the DES. ## 1.3 Mathematics Working Group

1. The mathematics working group discussed potential weaknesses of the DES, such as the limitations in key length, the non-random structure of the S-boxes, and possible vulnerabilities to less than exhaustion atacks. 2.

Report of the Workshop on Cryptography in Support of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

ncy official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal.
The information owner has the following responsibilities related to system security plans:

| CLASS       | FAMILY                                                 | IDENTIFIER   |
|-------------|--------------------------------------------------------|--------------|
| Management  | Risk Assessment                                        | RA           |
| Management  | Planning                                               | PL           |
| Management  | System and Services Acquisition                        | SA           |
| Management  | Certification, Accreditation, and Security Assessments | CA           |
| Operational | Personnel Security                                     | PS           |
| Operational | Physical and Environmental Protection                  | PE           |
| Operational | Contingency Planning                                   | CP           |
| Operational | Configuration Management                               | CM           |
| Operational | Maintenance                                            | MA           |
| Operational | System and Information Integrity                       | SI           |
| Operational | Media Protection                                       | MP           |
| Operational | Incident Response                                      | IR           |
| Operational | Awareness and Training                                 | AT           |
| Technical   | Identification and Authentication                      | IA           |
| Technical   | Access Control                                         | AC           |
| Technical   | Audit and Accountability                               | AU           |
| Technical   | System and Communications Protection                   | SC           |

| Configuration Control [CNSS Inst.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Digital Identity Guidelines:

FISMA requires federal agencies to implement appropriate controls to protect federal
information and information systems from unauthorized access, use, disclosure,
disruption, or modification. The NIST RMF [NISTRMF] provides a process that integrates
security, privacy, and cyber supply chain risk management activities into the system
development life cycle. It is expected that federal agencies and organizations that
provide services under these guidelines have already implemented the controls and
processes required under FISMA and associated NIST risk management processes and
publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

| 4.7   | Interrelationships among Policies ................................................................. | Interrelationships among Policies ................................................................. | 25                                                               |
|-------|-----------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------|
| 4.8   | Personal Accountability................................................................................. | Personal Accountability................................................................................. | 26                                                               |
| 4.9   | Anonymity, Unlinkability, and Unobservability............................................... | Anonymity, Unlinkability, and Unobservability...............................................

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to Security for Full Virtualization Technologies:

-  Phase 1: Initiation. This phase includes the tasks that an organization should perform before it starts to design a virtualization solution. These include identifying needs for virtualization, providing an overall vision for how virtualization solutions would support the mission of the organization, creating a high-level strategy for implementing virtualization solutions, developing virtualization policy, identifying platforms and applications that can be virtualized, and specifying business and functional requirements for the solution.
-  Phase 2: Planning and Design. In this phase, personnel specify the technical characteristics of the virtualization solution and related components. These include the authentication methods and the cryptographic mechanisms used to protect communications. At the end of this phase, solution components are procured.
-  Phase 3: Implementation. In this phase, equipment is configured to meet operational and security requirements, installed and tested as a prototype, and then activated on a production network. Implementation includes altering the configuration of other security controls and technologies, such as security event logging, network management, and authentication server integration.
-  Phase 4: Operations and Maintenance. This phase includes security-related tasks that an organization should perform on an ongoing basis once the virtualization solution is operational, including log review, attack detection, and incident response.
-  Phase 5: Disposition. This phase encompasses tasks that occur when a virtualization solution is being retired, including preserving information to meet legal requirements, sanitizing media, and disposing of equipment properly.

Guide to Security for Full Virtualization Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

3.5.3.

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

implementing processes that may serve as inputs into an information security measurement program, ensuring that data gathering and reporting are clearly defined helps facilitate valid data collection.
Having a validation process in place to check the integrity, accuracy, and structure of the data provides a way to address potential errors before any analysis is done. By setting a standard process to validate data, an organization can have a repeatable way to look at the data and ensure its quality.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to An Introduction to Privacy Engineering and Risk Management in Federal Systems:

To support agencies' ability to conduct privacy engineering, this publication introduces a set of privacy engineering objectives-predictability, manageability, and disassociability-to help system engineers focus on the types of capabilities the system needs in order to demonstrate how an agency's privacy policies and system privacy requirements have been implemented. In addition, this report introduces a privacy risk model to enable agencies to conduct more consistent privacy risk assessments based on the likelihood that an operation performed by a system would create a problem for individuals when processing PII-a problematic data action-and the impact of the problematic data action should it occur.

'They [the FIPPs] are value statements rather than recipes, however. System planners often encounter difficulties when trying to operationalize them, particularly when assessing privacy risks and when establishing privacy requirements for designing and developing systems and technologies. Those activities require a well-articulated set of privacy objectives and a privacy risk assessment approach, from which privacy risks can be evaluated and implementation requirements can be developed.' 35

NIST has developed guidance for information security risk management-including the RMF, and guidance on risk assessment-which has informed much of the approach introduced in this report. 44 Although the concept of privacy risk is not new to federal policy, to date there has been no guidance on how to assess this risk. 45 Outside the federal government, standards such as the International Organization for Standardization (ISO) Privacy Framework and the Organization for the Advancement of Structured Information Standards (OASIS) Privacy Management Reference Model include provisions for privacy risk assessment as part of their frameworks or methodologies, but they do not provide guidance on how to actually conduct a risk assessment

An Introduction to Privacy Engineering and Risk Management in Federal Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Digital Identity Guidelines:

Digital Identity Guidelines

Digital Identity Guidelines

Temoshok D, Galluzzo R, LaSalle C, Lefkovitz N, Regenscheid A, Choong YY, Proud-
Madruga D, Gupta S (2025) Digital Identity Guidelines. (National Institute of Standards
and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-63-4.
https://doi.org/10.6028/NIST.SP.800-63-4